HTTP inspector.
Fetch a URL from this server and see what a client really goes through: every redirect, where the time goes on each hop, what the final response looks like, and whether the headers that protect visitors are actually there.
About this tool
This server fetches the URL you give it with redirects switched off, so each hop in a chain is its own request on its own connection. For every hop it records how long DNS resolution, the TCP connect, the TLS handshake, the wait for the first byte and the body download took, then follows the Location header and does it again, up to ten times. The body is read (up to 2 MB) so the download phase is real, but it is discarded and nothing is stored.
The final response is then checked for the headers that protect visitors in a browser: HSTS, Content-Security-Policy, framing controls, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy, along with version leakage in Server and X-Powered-By and the Secure, HttpOnly and SameSite flags on every cookie set along the way. Each check says what it found and why it matters, so the report can be handed straight to whoever owns the config.
Useful for: finding out why a link takes three redirects to land, checking an HTTP to HTTPS redirect is a 301 and not a 302, confirming HTTP/2 is negotiated end to end, seeing whether a CDN is actually compressing, and getting a security header review without a marketing page wrapped around it. The request is sent with a browser-like Accept and Accept-Encoding so the server behaves as it would for a real visitor. Only public hosts can be fetched.
From a terminal: curl "kirkdiamond.com/tools/http?url=example.com" or add &format=json.